more patches
diff --git a/alsa-cs4236-fix-error-return-comparison-of-an-unsigned-integer.patch b/alsa-cs4236-fix-error-return-comparison-of-an-unsigned-integer.patch
new file mode 100644
index 0000000..131ab0d
--- /dev/null
+++ b/alsa-cs4236-fix-error-return-comparison-of-an-unsigned-integer.patch
@@ -0,0 +1,37 @@
+From d60229d84846a8399257006af9c5444599f64361 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 22 Nov 2019 13:13:54 +0000
+Subject: ALSA: cs4236: fix error return comparison of an unsigned integer
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit d60229d84846a8399257006af9c5444599f64361 upstream.
+
+The return from pnp_irq is an unsigned integer type resource_size_t
+and hence the error check for a positive non-error code is always
+going to be true. A check for a non-failure return from pnp_irq
+should in fact be for (resource_size_t)-1 rather than >= 0.
+
+Addresses-Coverity: ("Unsigned compared against 0")
+Fixes: a9824c868a2c ("[ALSA] Add CS4232 PnP BIOS support")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20191122131354.58042-1-colin.king@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/isa/cs423x/cs4236.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/isa/cs423x/cs4236.c
++++ b/sound/isa/cs423x/cs4236.c
+@@ -293,7 +293,8 @@ static int snd_cs423x_pnp_init_mpu(int d
+ } else {
+ mpu_port[dev] = pnp_port_start(pdev, 0);
+ if (mpu_irq[dev] >= 0 &&
+- pnp_irq_valid(pdev, 0) && pnp_irq(pdev, 0) >= 0) {
++ pnp_irq_valid(pdev, 0) &&
++ pnp_irq(pdev, 0) != (resource_size_t)-1) {
+ mpu_irq[dev] = pnp_irq(pdev, 0);
+ } else {
+ mpu_irq[dev] = -1; /* disable interrupt */
diff --git a/alsa-ice1724-fix-sleep-in-atomic-in-infrasonic-quartet-support-code.patch b/alsa-ice1724-fix-sleep-in-atomic-in-infrasonic-quartet-support-code.patch
new file mode 100644
index 0000000..68158e5
--- /dev/null
+++ b/alsa-ice1724-fix-sleep-in-atomic-in-infrasonic-quartet-support-code.patch
@@ -0,0 +1,64 @@
+From 0aec96f5897ac16ad9945f531b4bef9a2edd2ebd Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 18 Dec 2019 20:26:06 +0100
+Subject: ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0aec96f5897ac16ad9945f531b4bef9a2edd2ebd upstream.
+
+Jia-Ju Bai reported a possible sleep-in-atomic scenario in the ice1724
+driver with Infrasonic Quartet support code: namely, ice->set_rate
+callback gets called inside ice->reg_lock spinlock, while the callback
+in quartet.c holds ice->gpio_mutex.
+
+This patch fixes the invalid call: it simply moves the calls of
+ice->set_rate and ice->set_mclk callbacks outside the spinlock.
+
+Reported-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/5d43135e-73b9-a46a-2155-9e91d0dcdf83@gmail.com
+Link: https://lore.kernel.org/r/20191218192606.12866-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/ice1712/ice1724.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/ice1712/ice1724.c
++++ b/sound/pci/ice1712/ice1724.c
+@@ -663,6 +663,7 @@ static int snd_vt1724_set_pro_rate(struc
+ unsigned long flags;
+ unsigned char mclk_change;
+ unsigned int i, old_rate;
++ bool call_set_rate = false;
+
+ if (rate > ice->hw_rates->list[ice->hw_rates->count - 1])
+ return -EINVAL;
+@@ -686,7 +687,7 @@ static int snd_vt1724_set_pro_rate(struc
+ * setting clock rate for internal clock mode */
+ old_rate = ice->get_rate(ice);
+ if (force || (old_rate != rate))
+- ice->set_rate(ice, rate);
++ call_set_rate = true;
+ else if (rate == ice->cur_rate) {
+ spin_unlock_irqrestore(&ice->reg_lock, flags);
+ return 0;
+@@ -694,12 +695,14 @@ static int snd_vt1724_set_pro_rate(struc
+ }
+
+ ice->cur_rate = rate;
++ spin_unlock_irqrestore(&ice->reg_lock, flags);
++
++ if (call_set_rate)
++ ice->set_rate(ice, rate);
+
+ /* setting master clock */
+ mclk_change = ice->set_mclk(ice, rate);
+
+- spin_unlock_irqrestore(&ice->reg_lock, flags);
+-
+ if (mclk_change && ice->gpio.i2s_mclk_changed)
+ ice->gpio.i2s_mclk_changed(ice);
+ if (ice->gpio.set_pro_rate)
diff --git a/ata-libahci_platform-export-again-ahci_platform_-en-dis-able_phys.patch b/ata-libahci_platform-export-again-ahci_platform_-en-dis-able_phys.patch
new file mode 100644
index 0000000..1c70992
--- /dev/null
+++ b/ata-libahci_platform-export-again-ahci_platform_-en-dis-able_phys.patch
@@ -0,0 +1,76 @@
+From 84b032dbfdf1c139cd2b864e43959510646975f8 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Tue, 10 Dec 2019 10:53:44 -0800
+Subject: ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit 84b032dbfdf1c139cd2b864e43959510646975f8 upstream.
+
+This reverts commit 6bb86fefa086faba7b60bb452300b76a47cde1a5
+("libahci_platform: Staticize ahci_platform_<en/dis>able_phys()") we are
+going to need ahci_platform_{enable,disable}_phys() in a subsequent
+commit for ahci_brcm.c in order to properly control the PHY
+initialization order.
+
+Also make sure the function prototypes are declared in
+include/linux/ahci_platform.h as a result.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libahci_platform.c | 6 ++++--
+ include/linux/ahci_platform.h | 2 ++
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -49,7 +49,7 @@ static struct scsi_host_template ahci_pl
+ * RETURNS:
+ * 0 on success otherwise a negative error code
+ */
+-static int ahci_platform_enable_phys(struct ahci_host_priv *hpriv)
++int ahci_platform_enable_phys(struct ahci_host_priv *hpriv)
+ {
+ int rc, i;
+
+@@ -77,6 +77,7 @@ disable_phys:
+ }
+ return rc;
+ }
++EXPORT_SYMBOL_GPL(ahci_platform_enable_phys);
+
+ /**
+ * ahci_platform_disable_phys - Disable PHYs
+@@ -84,7 +85,7 @@ disable_phys:
+ *
+ * This function disables all PHYs found in hpriv->phys.
+ */
+-static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv)
++void ahci_platform_disable_phys(struct ahci_host_priv *hpriv)
+ {
+ int i;
+
+@@ -96,6 +97,7 @@ static void ahci_platform_disable_phys(s
+ phy_exit(hpriv->phys[i]);
+ }
+ }
++EXPORT_SYMBOL_GPL(ahci_platform_disable_phys);
+
+ /**
+ * ahci_platform_enable_clks - Enable platform clocks
+--- a/include/linux/ahci_platform.h
++++ b/include/linux/ahci_platform.h
+@@ -22,6 +22,8 @@ struct ata_port_info;
+ struct ahci_host_priv;
+ struct platform_device;
+
++int ahci_platform_enable_phys(struct ahci_host_priv *hpriv);
++void ahci_platform_disable_phys(struct ahci_host_priv *hpriv);
+ int ahci_platform_enable_clks(struct ahci_host_priv *hpriv);
+ void ahci_platform_disable_clks(struct ahci_host_priv *hpriv);
+ int ahci_platform_enable_resources(struct ahci_host_priv *hpriv);
diff --git a/gpiolib-fix-up-emulated-open-drain-outputs.patch b/gpiolib-fix-up-emulated-open-drain-outputs.patch
new file mode 100644
index 0000000..a67b9a3
--- /dev/null
+++ b/gpiolib-fix-up-emulated-open-drain-outputs.patch
@@ -0,0 +1,44 @@
+From 256efaea1fdc4e38970489197409a26125ee0aaa Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Sat, 7 Dec 2019 16:20:18 +0000
+Subject: gpiolib: fix up emulated open drain outputs
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+commit 256efaea1fdc4e38970489197409a26125ee0aaa upstream.
+
+gpiolib has a corner case with open drain outputs that are emulated.
+When such outputs are outputting a logic 1, emulation will set the
+hardware to input mode, which will cause gpiod_get_direction() to
+report that it is in input mode. This is different from the behaviour
+with a true open-drain output.
+
+Unify the semantics here.
+
+Cc: <stable@vger.kernel.org>
+Suggested-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -147,6 +147,14 @@ int gpiod_get_direction(const struct gpi
+ chip = gpiod_to_chip(desc);
+ offset = gpio_chip_hwgpio(desc);
+
++ /*
++ * Open drain emulation using input mode may incorrectly report
++ * input here, fix that up.
++ */
++ if (test_bit(FLAG_OPEN_DRAIN, &desc->flags) &&
++ test_bit(FLAG_IS_OUT, &desc->flags))
++ return 0;
++
+ if (!chip->get_direction)
+ return status;
+
diff --git a/series b/series
index e69de29..a15db53 100644
--- a/series
+++ b/series
@@ -0,0 +1,5 @@
+alsa-ice1724-fix-sleep-in-atomic-in-infrasonic-quartet-support-code.patch
+taskstats-fix-data-race.patch
+ata-libahci_platform-export-again-ahci_platform_-en-dis-able_phys.patch
+gpiolib-fix-up-emulated-open-drain-outputs.patch
+alsa-cs4236-fix-error-return-comparison-of-an-unsigned-integer.patch
diff --git a/taskstats-fix-data-race.patch b/taskstats-fix-data-race.patch
new file mode 100644
index 0000000..03beef9
--- /dev/null
+++ b/taskstats-fix-data-race.patch
@@ -0,0 +1,101 @@
+From 0b8d616fb5a8ffa307b1d3af37f55c15dae14f28 Mon Sep 17 00:00:00 2001
+From: Christian Brauner <christian.brauner@ubuntu.com>
+Date: Wed, 9 Oct 2019 13:48:09 +0200
+Subject: taskstats: fix data-race
+
+From: Christian Brauner <christian.brauner@ubuntu.com>
+
+commit 0b8d616fb5a8ffa307b1d3af37f55c15dae14f28 upstream.
+
+When assiging and testing taskstats in taskstats_exit() there's a race
+when setting up and reading sig->stats when a thread-group with more
+than one thread exits:
+
+write to 0xffff8881157bbe10 of 8 bytes by task 7951 on cpu 0:
+ taskstats_tgid_alloc kernel/taskstats.c:567 [inline]
+ taskstats_exit+0x6b7/0x717 kernel/taskstats.c:596
+ do_exit+0x2c2/0x18e0 kernel/exit.c:864
+ do_group_exit+0xb4/0x1c0 kernel/exit.c:983
+ get_signal+0x2a2/0x1320 kernel/signal.c:2734
+ do_signal+0x3b/0xc00 arch/x86/kernel/signal.c:815
+ exit_to_usermode_loop+0x250/0x2c0 arch/x86/entry/common.c:159
+ prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
+ syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
+ do_syscall_64+0x2d7/0x2f0 arch/x86/entry/common.c:299
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+read to 0xffff8881157bbe10 of 8 bytes by task 7949 on cpu 1:
+ taskstats_tgid_alloc kernel/taskstats.c:559 [inline]
+ taskstats_exit+0xb2/0x717 kernel/taskstats.c:596
+ do_exit+0x2c2/0x18e0 kernel/exit.c:864
+ do_group_exit+0xb4/0x1c0 kernel/exit.c:983
+ __do_sys_exit_group kernel/exit.c:994 [inline]
+ __se_sys_exit_group kernel/exit.c:992 [inline]
+ __x64_sys_exit_group+0x2e/0x30 kernel/exit.c:992
+ do_syscall_64+0xcf/0x2f0 arch/x86/entry/common.c:296
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fix this by using smp_load_acquire() and smp_store_release().
+
+Reported-by: syzbot+c5d03165a1bd1dead0c1@syzkaller.appspotmail.com
+Fixes: 34ec12349c8a ("taskstats: cleanup ->signal->stats allocation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Acked-by: Marco Elver <elver@google.com>
+Reviewed-by: Will Deacon <will@kernel.org>
+Reviewed-by: Andrea Parri <parri.andrea@gmail.com>
+Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
+Link: https://lore.kernel.org/r/20191009114809.8643-1-christian.brauner@ubuntu.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/taskstats.c | 30 +++++++++++++++++++-----------
+ 1 file changed, 19 insertions(+), 11 deletions(-)
+
+--- a/kernel/taskstats.c
++++ b/kernel/taskstats.c
+@@ -591,25 +591,33 @@ static int taskstats_user_cmd(struct sk_
+ static struct taskstats *taskstats_tgid_alloc(struct task_struct *tsk)
+ {
+ struct signal_struct *sig = tsk->signal;
+- struct taskstats *stats;
++ struct taskstats *stats_new, *stats;
+
+- if (sig->stats || thread_group_empty(tsk))
+- goto ret;
++ /* Pairs with smp_store_release() below. */
++ stats = smp_load_acquire(&sig->stats);
++ if (stats || thread_group_empty(tsk))
++ return stats;
+
+ /* No problem if kmem_cache_zalloc() fails */
+- stats = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL);
++ stats_new = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL);
+
+ spin_lock_irq(&tsk->sighand->siglock);
+- if (!sig->stats) {
+- sig->stats = stats;
+- stats = NULL;
++ stats = sig->stats;
++ if (!stats) {
++ /*
++ * Pairs with smp_store_release() above and order the
++ * kmem_cache_zalloc().
++ */
++ smp_store_release(&sig->stats, stats_new);
++ stats = stats_new;
++ stats_new = NULL;
+ }
+ spin_unlock_irq(&tsk->sighand->siglock);
+
+- if (stats)
+- kmem_cache_free(taskstats_cache, stats);
+-ret:
+- return sig->stats;
++ if (stats_new)
++ kmem_cache_free(taskstats_cache, stats_new);
++
++ return stats;
+ }
+
+ /* Send pid data out on exit */
